Read the docs
TI-2023-14776 Aliases CVE-2023-31039GHSA-8fwm-xh4w-q393

Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution

Priority MEDIUM 52CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process. Solution: 1. upgrade to bRPC >= 1.5.0, download link:  https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:  https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01522 74th percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPC0.9.0 to before 1.5.01.5.0Patch availableCNA
  • Apache bRPC VendorApache Affected 0.9.0 to before 1.5.0 Fixed in 1.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*0.9.0 to before 1.5.0VulnerableApache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions 0.9.0 to before 1.5.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31039
  2. 2026-10-03 Alias added: GHSA-8fwm-xh4w-q393

References

Patch 2

  • TI-2025-37397 Apache bRPC: Remote command injection vulnerability in heap builtin service CVSS 3.1CRITICAL 9.8
  • TI-2025-37239 Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser CVSS 3.1HIGH 7.5
  • TI-2025-34269 Apache bRPC: Redis Parser Remote Denial of Service CVSS 3.1HIGH 7.5
  • TI-2024-15499 Apache bRPC: HTTP request smuggling vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-24531 Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences